Breach

CIS Controls v8 (Part 3)

Summary
Last month, nGuard released a security advisory called CIS Controls v8 (Part 2) where we covered controls 7-12. This time, we are wrapping it up by covering the remaining 8 controls that are essential for a company who puts emphasis on a strong security posture. Read about these controls below and then take action within your organization to implement them.

Controls
Control 13: Network Monitoring and Defense
If an attacker gained access to your internal network, would you even know that it happened? It is essential that tools be in place to monitor network traffic for malicious activity and take action if necessary. Implementing an intrusion prevention system and log management system, then configuring it to meet the needs of your organization can halt simple attacks in their tracks.

Control 14: Security Awareness and Skills Training
Employees are the weakest link in the chain of organizational security landscape. Step 1 for any company looking to increase their security posture should be training employees to put a halt to social engineering attempts. At nGuard, we regularly conduct advanced social engineering campaigns for our customers — their employees fall for it every time. It is essential to establish and maintain a security awareness program for employees and conduct simulations if possible. Make security part of your company’s culture.

Control 15: Service Provider Management
We have been seeing a lot of disturbing headlines lately in which companies release data to third-parties and those vendors allow the data to become compromised. While the vendor may be responsible, perhaps the contracting organization didn’t conduct proper due diligence. Take service provider management seriously by having a developed process in place to evaluate whether or not this vendor is going to put security first while in possession of your sensitive data.

Control 16: Application Software Security
Any nGuard engineer will tell you that the easiest way to compromise a system is by exploiting critical, widely-known vulnerabilities due to outdated or unsupported software. Although these companies rely on a slew of software packages to conduct daily business operations, they fail to update them when security patches are released. nGuard recommends that you maintain a list of firmware and software that will need to be updated; sign up for mailing lists that will alert you when new patches are to be released; and configure automatic updates if possible. Do not let your software be outdated for an extended period of time!

Control 17: Incident Response Management
Many security professionals will tell you that it’s not a matter of “if,” but a matter of “when” a company will become compromised in some form or fashion. Is your organization prepared to recover from a ransomware attack? If not, maybe it’s time to think about this. Having a well-developed incident response plan in place can prevent a world a trouble. Develop policies, plans, procedures, define roles, conduct training, and develop communication plans to mitigate threats. Once these measures have been implemented, conduct table top exercises to test the plan you have put in place.

Control 18: Penetration Testing
This is nGuard’s favorite control. Penetration testing attempts to evaluate the security of an IT infrastructure by safely trying to exploit vulnerabilities. While vulnerability scans do a great job of pointing you to the low hanging fruit that attackers will take advantage of, penetration testing brings a real-world expert into your environment to chain together vulnerabilities and give you a better evaluation of potential risk. Start with external penetration testing to secure your public facing infrastructure and then move to internal penetration testing to make life harder for an attacker that gets in.

Next Steps
nGuard offers a wide variety of services that will help guide your organization on its path to implementing these critical security controls. Our Strategic Security Assessment allows your organization’s key players the opportunity to sit down with a security consultant who knows these controls like the back of their hand. Not only will they help you strengthen the controls that are already in place, they will make recommendations for the areas in which your organization falls short. Below are some other ways nGuard can help your business implement these controls:

This Week In Cybersecurity (TWIC)

It’s another busy week in the world of cybersecurity and nGuard wants to keep our advisory readers up to date. This week, nGuard is bringing you everything from the US State Department being attacked to Microsoft Power Apps leaking 38 million records.

US State Department Hit By Cyber-Attack

On August 21, Fox News journalist Jacqui Heinrich reported that the U.S. State Department suffered a cyber-attack. This led to the Department of Defense Cyber Command making notifications of a possible serious breach. A spokesperson for the State Department was quoted as saying, “The department takes seriously its responsibility to safeguard its information and continuously takes steps to ensure information is protected. For security reasons, we are not in a position to discuss the nature or scope of any alleged cybersecurity incidents at this time.” The State Department will not likely release any details of the attack. This comes in the wake of recent attacks on Colonial Pipeline and JBS from Russia, and the Microsoft Exchange Server attacks originating from China.

AT&T Data Being Sold On The Dark Web

Last week it was T-Mobile, this week it’s AT&T. The hacker gang, ShinyHunters, is claiming they have the data of 70 million AT&T customers personal identifiable information (PII) which includes names, phone numbers, social security numbers, dates of birth, addresses, and more. ShinyHunters are selling the data on RaidForums in small segments for $30,000 or the entire database for $1 million. AT&T has denied this information came from their systems.

Microsoft Power Apps Leaks 38 Million Records

The data of 38 million people was mistakenly exposed to the internet which was caused by an issue with more than 1000 Microsoft web applications. Some of the companies that were affected are American Airlines, Ford, J.B. Hunt, the Maryland Department of Health, the New York City Municipal Transportation Authority, and New York City public schools. The information leaked included COVID-19 contact tracing platforms, vaccination information, job application portals, and employee databases. The information included vaccination status, social security numbers, home addresses, and phone numbers. The flaw that allowed this leak to occur was in the Power Apps application programming interface (API) default setting which opened the information to the public. The privacy settings needed to be changed manually to prevent this from happening, but a majority of customers were not aware of this option.

President Biden Hosts Tech, Energy, Finance Leaders Meet In ‘Call to Action’

On Wednesday August 25^th, Apple, Amazon, Google, Microsoft and chief executives from insurance, energy and water companies were summoned to the White House to focus on improving cybersecurity. This meeting comes as recent high-profile attacks like the SolarWinds and Microsoft Exchange attacks have become more frequent. The White House wanted to address these areas of concern and determine how to best protect the 16 Critical Infrastructure sectors. Additionally, nonprofit organizations focused on computer science education and several colleges were included in the meeting to discuss efforts on how to address the gap of roughly 500,000 vacant U.S. cybersecurity jobs.

This Week In Cybersecurity (TWIC)

It’s another busy week in the world of cybersecurity and nGuard wants to keep our advisory readers up-to-date. This week, nGuard is bringing you everything from a T-Mobile data breach that exposed some extremely sensitive data to a Windows zero-day that may allow remote code execution.

T-Mobile Data Breach
Late Sunday night, the U.S. Sun reported that T-Mobile USA had likely suffered a massive data breach. T-Mobile was made aware of the breach after a hacker posted large swaths of data for sale on a popular online hacking forum. Early reports show the information from over 100 million customers may be at risk. This data set includes drivers license information, physical addresses, phone numbers, names, social security numbers, and unique IMEI numbers.

Norton and Avast Merger
On August 11^th, the security community was made aware that anti-virus giants NortonLifeLock and Avast were going to merge in a deal worth more than $8 billion. While both companies offer a similar product set, Norton’s experience with identity logistics and Avast’s individual focus on privacy could lead us down the path to the ultimate anti-virus product. With ransomware attacks on the rise, this merger could be timely for security professionals.

Gigabyte Ransomware Attack
Bleeping Computer and United Daily News were the first to report that Taiwan-based computer manufacturer, Gigabyte, had been the latest company to suffer a large-scale ransomware attack. Early reports are confirming that IT infrastructure was shut down, but the attack may be worse than originally expected. The attack appears to have been carried out by an organization called RansomEXX. This organization is also responsible for the attacks on the Brazilian government and the Texas’ Department of Transportation.

Windows Print Spooler Zero-Day
Late last week, Microsoft confirmed the presence of a Windows print spooler vulnerability now known as CVE-2021-36958. This is one of many vulnerabilities in a class of bugs known as “PrintNightmare.” This vulnerability utilizes the CopyFile registry directive on the device to copy a DLL file that ultimately allows an attacker to gain SYSTEM level privileges on the device. Microsoft quickly released security updates to address this vulnerability.

LinkedIn Breached Again!

Summary
Remember when someone discovered a misconfigured database exposed to the internet that left the information of 500 million LinkedIn users at risk? It’s happening again, except this time 700 million users have been impacted. Multiple outlets are now reporting that a hacker appears to have used the LinkedIn API in a malicious way which led to the download of large amounts of user data. This is extremely similar to the April incident in which an online database was compromised and user data was sold online. With both incidents, the user data has appeared for sale on a popular site called raidforums.com. Here, users can download large amounts of compromised data for any purpose. Hackers were able to compromise the following:

Email Addresses
Full Names
Phone Numbers
Physical Addresses
Geolocation Records
Usernames and Profile URLs
Genders
Other Social Media Accounts

Although this data set doesn’t contain cleartext passwords or password hashes, it does contain sensitive information that could be used in targeted social engineering attacks. Attackers utilize detailed information about employees to launch intricate social engineering campaigns that can be highly successful. When an unsuspecting employee receives a spoofed email with personal information included, it often makes it seem more legitimate. It is important to train your employees to look out for this type of targeted social engineering.

Awareness Training Helps
nGuard has been studying the art of social engineering and conducting simulations for its customers for nearly 20 years. nGuard’s highly trained engineers are well versed in the techniques used by adversaries and can conduct real world scenarios. This aids organizations in training their employees to expect the unexpected.

Colonial Pipeline Update

Summary
This is a follow up to a previous Security Advisory. For the initial timeline please visit Colonial Pipeline Timeline of Events.

Since the last Colonial Pipeline Security Advisory, there have been several updates related to the breach. Details were released on how the attackers gained initial access to Colonial’s internal network, the FBI was able to recover much of the bitcoin paid to the ransomware group (Darkside), and the Senate Homeland Security Committee held a hearing on the breach.

In the beginning of June, Bloomberg reported that the initial access gained by DarkSide was through a Virtual Private Network (VPN) account, which is used to gain remote access to private networks. The target account was no longer in use but remained active. The password associated with the account was discovered in a database of leaked passwords that are available on the dark web. Additionally, the VPN account did not utilize multi-factor authentication (MFA), which made gaining access much easier. The breach investigation stated that it is not known exactly how the password and username combination was compromised and likely they will never know. Only a week after the initial access was gained, ransomware was deployed resulting in the catastrophic damage to Colonial Pipeline and their supply chain.

On Monday June 7^th, the Department of Justice (DOJ) announced it had successfully recovered 63.7 Bitcoins worth approximately $2.3 million from DarkSide. The FBI was able to discover the address of the virtual wallet used through blockchain’s public ledger. The FBI had the private key, which is like a password, used to access the wallet and seize the bitcoins. The FBI has not stated how they obtained the private key, but this shows that criminals who use bitcoin and other cryptocurrency in their activity are not as immune to law enforcement as once believed.

On June 8^th, the Senate Homeland Security Committee held a hearing with the CEO of Colonial Pipeline, Joseph Blount. When discussing paying the ransom Joseph said, “It was one of the toughest decisions I have had to make in my life. At the time, I kept this information close hold [sic] because we were concerned about operational security and minimizing publicity for the threat actor. But I believe that restoring critical infrastructure as quickly as possible, in this situation, was the right thing to do for the country.” The hearing covered Colonial Pipeline’s security readiness and response to the event while putting a bigger spotlight on the gaps in security within the U.S energy infrastructure and country as a whole.

What Can Your Organization Do?
Cybersecurity cannot continue to be a reactive process. Security needs to be a priority from the ground up with infrastructure built around security. Discovering gaps in your organization’s security landscape can be simplified with an nGuard Strategic Security Assessment. Utilizing the Center for Internet Security Controls Version 8, nGuard can help you find ways to create a more mature security organization. If your organization does fall victim to a ransomware attack like Colonial Pipeline, bring in our experts to conduct a Cybersecurity Incident Response.

Colonial Pipeline – Timeline Of Events

On Friday May 7th Colonial Pipeline suffered a cyberattack involving ransomware, causing them to shutdown their IT systems and temporarily pause production on a majority of their pipelines. Additional details of the attack are still coming out each day, but here is a current timeline of events and details of how the hacker group, DarkSide, has carried out its attacks based on publicly available information.

May 6th
Colonial Pipeline networks are breached, 100GB of data is stolen and computers are encrypted with ransomware.

May 7th
Colonial Pipeline paid $4.4 million to DarkSide hacking group to decrypt their infrastructure.

May 8th
Colonial Pipeline, along with U.S. Government organizations and U.S. companies take systems offline that were in control by the hackers.

Colonial Pipeline issues statement on attack stating they have been victims of ransomware and have engaged a third-party cybersecurity firm and alerted law enforcement. Source:Colonial Pipeline Statement

May 9th
Colonial Pipeline issues second statement giving an update of their investigation into the attack and the status of their pipeline operations. Source: Colonial Pipeline Statement

May 10th
FBI issues statement confirming DarkSide is the responsible party for the hack.

Colonial Pipeline issues a statement that their goal is to substantially restore service by the end of the week.

Colonial Pipeline manually operates a line from Greensboro, NC to Woodbine, MD for a limited period of time, but other main lines continue to be offline.

May 11th
CISA and FBI issue cybersecurity advisory describing ransomware used by DarkSide with strategies for risk mitigation. Source:Joint Advisory.

Colonial Pipeline’s website is offline for part of the day.

May 12th
Colonial Pipeline’s website is restored and a new website is provided to address their response to the attack. Source: CP Cyber Response

Colonial Pipeline is able to restart services around 5:00pm. It will still take many days to replenish the depleted supply chain after panic buying of fuel and delayed fuel deliveries.

How Did Darkside Launch the Attack?
Based on research of DarkSide, the below methods are the tactics they have typically followed in recent attacks. Source: DarkSide Ransomware Research

Attackers were able to gain access in a few different ways:
1. Phishing attacks
2. Brute-force password attacks
3. SQL Injection against VPN networks
4. Utilizing TeamViewer
5. Installing backdoors
Once inside the network, attackers escalated privileges by:
1. Exploiting the Zerologon vulnerability.
2. Utilizing Mimikatz.
3. Accessing and dumping Local Security Authority Subsystem Service (LSASS).
With privileged access, DarkSide uses PowerShell and Certutil to deploy and execute the ransomware across the network.

Where to go from here?
The attack methods used by DarkSide should lead to a review of your organization’s security assessment programs to ensure the below critical assessment activities are included.

nGuard’s security assessment portfolio can help your organization find your vulnerabilities before the bad guys do. If your organization falls victim to a ransomware attack like Colonial Pipeline, bring in our experts for your Cybersecurity Incident Response.